Privacy Policy

1. Who We Are

Ardore ("we," "us," "our") operates the website ardore.app and the Ardore mobile application (together, the "Platform"). Ardore is a members-only travel and dating platform that connects verified, globally mobile singles through how they travel.

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Ardore is the Data Fiduciary — meaning we determine the purpose and means of processing your personal data.

2. Data Protection Officer

In accordance with Section 8(8) of the DPDP Act, we have appointed a Data Protection Officer who serves as your point of contact for all matters related to the processing of your personal data and the exercise of your rights.

3. What Personal Data We Collect

We collect only the personal data that is necessary for the specific purposes described in Section 4 below. We will never collect more than what is needed.

Data we do not collect

• Precise real-time location (we never track or share your exact location with other members)
• Biometric data beyond photo matching for verification
• Data from children under 18 (we do not knowingly process data of anyone under 18 years of age)

4. Purpose of Processing

Under Section 4 of the DPDP Act, we process your personal data only for lawful purposes. Below is an itemised description of each purpose, as required by Section 5:

• Account creation and membership — to register you, verify your identity, and manage your Ardore membership.
• Travel DNA matching — to calculate compatibility scores and show you relevant matches based on shared travel preferences and destinations.
• Communication — to enable messaging between matched members and send you service notifications (welcome emails, match alerts, booking confirmations).
• Safety and trust — to verify ages (18+ enforcement), prevent fraud, investigate reports of harassment or abuse, and maintain a safe community.
• Payments and bookings — to process subscription payments and hotel booking commissions through our payment processor (Stripe).
• Platform improvement — to understand how the Platform is used and improve features, fix bugs, and enhance user experience.
• Legal compliance — to comply with applicable laws, respond to legal requests, and protect our rights.

We will not process your data for any purpose beyond what is listed above without obtaining your separate, specific consent.

5. Consent

Under Section 6 of the DPDP Act, we collect your personal data based on your free, specific, informed, unconditional, and unambiguous consent, given through a clear affirmative action (submitting your application, creating your profile, or ticking a consent checkbox).

Your consent rights

• You may withdraw your consent at any time by contacting us at [email protected] or through your account Settings page.
• Withdrawing consent is as easy as giving it — one email or one button click.
• If you withdraw consent, we will stop processing your data for that purpose. However, withdrawal does not affect the lawfulness of processing done before withdrawal.
• You may appoint a Consent Manager registered with the Data Protection Board to manage your consent on your behalf, as provided under Section 6(9) of the DPDP Act.

6. Notice Under Section 5

This Privacy Policy serves as the notice required under Section 5 of the DPDP Act. Before or at the time of collecting your personal data, we provide you with:

• An itemised description of the personal data being collected (Section 3 above)
• The specific purpose of processing (Section 4 above)
• How to exercise your rights, including withdrawal of consent and filing complaints (Sections 8 and 9 below)
• Contact details of the Data Protection Officer (Section 2 above)

This notice is available in English. A Hindi translation is available on request by emailing [email protected].

7. How We Protect Your Data

Under Section 8 of the DPDP Act, we implement reasonable security safeguards to protect your personal data from unauthorised access, loss, or breach. These include:

• Encryption in transit — all data transmitted between your device and our servers is encrypted using TLS/SSL (Full Strict mode via Cloudflare).
• Encryption at rest — sensitive data including passwords (hashed with bcrypt), ID documents, and messages are encrypted in our database.
• Access controls — only authorised personnel can access personal data, limited to what is necessary for their role.
• Rate limiting — automated protections against brute-force attacks and abuse (100 requests per 15 minutes general; 10 per 15 minutes for signups).
• Bot protection — Cloudflare Bot Fight Mode and DDoS protection active on all endpoints.
• Input sanitisation — all user inputs are sanitised to prevent injection attacks.
• Content Security Policy — strict CSP headers prevent cross-site scripting and data injection.
• ID document handling — government-issued IDs used for verification are encrypted, accessed only during the verification process, and permanently deleted within 30 days of verification completion.

8. Your Rights as a Data Principal

Under the DPDP Act, you are a "Data Principal" — the person whose data we process. You have the following rights:

Right to access (Section 11)

You may request a summary of the personal data we hold about you, the processing activities undertaken, and any third parties or Data Processors with whom your data has been shared. We will respond within 7 business days.

Right to correction and erasure (Section 12)

You may request that we correct inaccurate or incomplete personal data, update outdated data, or erase your personal data entirely when the purpose for which it was collected has been fulfilled or you have withdrawn consent.

Right to grievance redressal (Section 13)

If you are unsatisfied with how we handle your data, you may file a complaint with our Data Protection Officer. If our response does not resolve your concern, you have the right to file a complaint with the Data Protection Board of India at no cost. See Section 9 below for the full complaints procedure.

Right to nominate (Section 14)

You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. To register a nominee, contact our Data Protection Officer.

How to exercise your rights

Email [email protected] with the subject line "Data Principal Rights Request" or use the data request option in your account Settings page. We will verify your identity before processing any request and respond within 7 business days.

9. Grievance Redressal Procedure

Under Section 13 of the DPDP Act, we maintain a clear procedure for addressing your concerns about data processing:

• Step 1: Contact our Data Protection Officer at [email protected]. Describe your concern in detail.
• Step 2: We will acknowledge your complaint within 48 hours and provide a resolution within 7 business days.
• Step 3: If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India under Section 13(2) of the DPDP Act. No fee is charged for filing a complaint with the Board.

10. Data Sharing and Processors

We do not sell your personal data. We share data only with the following categories of Data Processors, and only to the extent necessary for the purposes described in Section 4:

All Data Processors are contractually bound to process your data only as instructed by us and to maintain appropriate security safeguards.

11. Data Retention

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected:

When the retention period expires, we securely erase or anonymise the data so it can no longer be associated with you.

12. Children's Data

Ardore is strictly an 18+ platform. We do not knowingly collect, process, or store personal data of anyone under the age of 18.

Under Section 9 of the DPDP Act, processing personal data of children requires verifiable consent from a parent or lawful guardian. Since Ardore is a dating platform, we enforce a blanket prohibition on minors rather than seeking parental consent — no person under 18 may register, apply, or use the Platform.

Our application form requires date-of-birth verification. If we discover that a member is under 18, we will immediately suspend their account and delete all associated personal data.

13. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India within 72 hours of becoming aware of the breach, as required under Section 8(6) of the DPDP Act.
• Notify you (the affected Data Principal) without unreasonable delay, describing the nature of the breach, the data affected, and what steps we are taking.
• Take immediate steps to contain the breach, investigate the cause, and prevent recurrence.

14. Cross-Border Data Transfer

Your data may be processed on servers located outside India (our hosting infrastructure uses Railway, which operates servers in regions including the United States). We ensure that any cross-border transfer complies with the DPDP Act and that adequate safeguards are in place.

We do not transfer data to any country that the Central Government has restricted under Section 16(1) of the DPDP Act.

Transfers from the EU/EEA

Where your personal data is transferred from the European Economic Area to countries not deemed to have an adequate level of data protection by the European Commission, we rely on Standard Contractual Clauses (SCCs) approved under Commission Implementing Decision (EU) 2021/914, supplemented by additional safeguards where necessary (including encryption in transit and at rest). You may request a copy of the applicable SCCs by contacting our Data Protection Officer.

Transfers from the United Kingdom

For transfers of personal data from the UK, we rely on the International Data Transfer Agreement (IDTA) or the UK Addendum to EU SCCs, as approved by the Information Commissioner's Office.

Transfers from the UAE

Cross-border transfers of personal data from the UAE are conducted in compliance with the UAE PDPL (Federal Decree-Law No. 45 of 2021), including transfers only to jurisdictions that provide an adequate level of protection or under appropriate safeguards approved by the UAE Data Office.

Transfers from Australia

Before disclosing your personal information to overseas recipients under Australian Privacy Principle 8, we take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to that information.

15. Cookies and Tracking

The Ardore website currently uses only essential technical cookies necessary for the Platform to function (session management, security tokens). We do not use advertising cookies, analytics trackers, or third-party tracking pixels.

If we introduce optional cookies in the future, we will update this policy and obtain your separate consent before deploying them.

Cookie Consent for EU/EEA and UK Users

In compliance with the EU ePrivacy Directive (2002/58/EC) and the UK Privacy and Electronic Communications Regulations 2003 (PECR), we will obtain your prior consent before placing any non-essential cookies on your device. Essential cookies (strictly necessary for the Platform to function) do not require consent. When optional cookies are introduced, you will be presented with a clear consent mechanism allowing you to accept or reject specific categories of cookies, and you may change your preferences at any time.

16. Account Deletion

You may delete your Ardore account at any time through your account Settings page or by emailing [email protected].

When you delete your account:

• Your profile, photos, Travel DNA, and preferences are permanently deleted within 30 days.
• Your messages to other members remain visible to those members but are disassociated from your identity.
• Payment records are retained as required by tax law.
• Safety and moderation records are retained for 3 years to protect the community.

17. Penalties and Accountability

We acknowledge that non-compliance with the DPDP Act carries significant penalties (up to ₹250 crore for security breaches, up to ₹200 crore for breach notification failures, and up to ₹200 crore for violations involving children's data). We take our obligations seriously and have designed our systems with compliance as a foundation, not an afterthought.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you by email if you are a registered member.
• Seek fresh consent where required by law for any new processing purposes.

19. For Residents of the EU / EEA (GDPR)

If you reside in the European Union or European Economic Area, the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies to our processing of your personal data. This section supplements the rest of this Privacy Policy with information required under the GDPR.

Lawful basis for processing

Your additional rights under the GDPR

In addition to the rights described in Section 8 above, you have:

• Right to data portability (Art. 20) — receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV), and have it transmitted directly to another controller where technically feasible.
• Right to object (Art. 21) — object to processing based on legitimate interests, including profiling for matching purposes. If you object, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to restrict processing (Art. 18) — request restriction of processing while we verify accuracy, assess an objection, or where processing is unlawful but you oppose erasure.
• Right not to be subject to automated decision-making (Art. 22) — our matching algorithm provides suggestions only; no decision with legal or similarly significant effect is made solely by automated processing.

Cross-border transfers

Your data is transferred outside the EEA (to servers in the United States and India). These transfers are protected by Standard Contractual Clauses (SCCs) adopted under Commission Implementing Decision (EU) 2021/914, supplemented by encryption in transit (TLS) and at rest. You may request a copy of the applicable safeguards by emailing [email protected].

Supervisory authority

You have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. A list of EU data protection authorities is available at edpb.europa.eu.

Data retention

We retain your data only as long as necessary for the purposes described in this Policy, or as required by applicable law. The retention periods in Section 11 apply. Where you withdraw consent or request erasure, we will delete your data unless we have a legal obligation to retain it.

20. For California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA", Cal. Civ. Code § 1798.100 et seq.) provides you with specific rights regarding your personal information. This section serves as our required CCPA/CPRA disclosure.

Categories of personal information collected

Sale, sharing, and targeted advertising

Ardore does not sell your personal information as defined under the CCPA. We do not share your personal information for cross-context behavioural advertising as defined under the CPRA. We do not use your data for targeted advertising by third parties.

Your CCPA/CPRA rights

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months, the sources, the purposes, and the categories of third parties to whom we disclosed it.
• Right to delete — request deletion of your personal information, subject to statutory exceptions (e.g., completing a transaction, legal obligations, security).
• Right to correct — request correction of inaccurate personal information.
• Right to limit use of sensitive PI — direct us to limit the use of sensitive personal information (including government ID data) to purposes necessary to provide the services.
• Right to opt out of sale/sharing — although we do not sell or share your data, you may submit a request at any time and we will confirm our practices.
• Non-discrimination — we will not deny you services, charge different prices, or provide a different quality of service for exercising your CCPA/CPRA rights.

Financial incentive disclosure

Ardore offers different membership tiers at different prices (Founding Member, Membership, Voyager). These pricing differences reflect the different levels of service and access provided, not the value of your personal information. We do not offer financial incentives conditioned on the collection, retention, or sale of personal information.

How to exercise your rights

Email [email protected] with the subject line "California Privacy Request." You may also designate an authorised agent to make a request on your behalf by providing written authorisation. We will verify your identity (and your agent's authority) before processing any request and respond within 45 days (extendable by an additional 45 days with notice).

Metrics

In accordance with CCPA regulations, we will compile and disclose annual metrics on the number of data requests received, complied with, and denied upon request.

21. For UK Residents (UK GDPR & DPA 2018)

If you reside in the United Kingdom, the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 apply to our processing of your personal data.

Your rights under the UK GDPR mirror those described in Section 19 (EU GDPR) above, including the rights to access, rectification, erasure, portability, objection, and restriction of processing.

Cross-border transfers

Transfers of your personal data outside the UK are protected by the International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses, as approved by the Information Commissioner's Office.

Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

22. For UAE Residents (PDPL)

If you reside in the United Arab Emirates, the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") and its implementing regulations apply to our processing of your personal data.

Your rights under the UAE PDPL

• Right to access — request access to your personal data and information about how it is processed.
• Right to correction — request correction of inaccurate or incomplete personal data.
• Right to deletion — request deletion of your personal data when the purpose of processing has been fulfilled or your consent has been withdrawn.
• Right to restrict or stop processing — request that we restrict or cease processing your personal data in certain circumstances.
• Right to data portability — request transfer of your personal data in a commonly used format.
• Right to withdraw consent — withdraw your consent to processing at any time, without affecting the lawfulness of processing carried out before withdrawal.

Cross-border transfers

Transfers of your personal data outside the UAE are conducted in compliance with the PDPL, including transfers only to jurisdictions that provide an adequate level of data protection or under appropriate contractual safeguards as approved by the UAE Data Office.

Content standards

Members accessing Ardore from the UAE acknowledge that content shared on the Platform must comply with applicable UAE laws, including Federal Decree-Law No. 34 of 2021 (regarding combatting rumours and cybercrimes). Ardore reserves the right to moderate or remove content that violates these standards.

Complaints

You may file a complaint regarding the processing of your personal data with the UAE Data Office if you are not satisfied with our response to your enquiry.

23. For Australian Residents (Privacy Act 1988)

If you reside in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to our handling of your personal information.

Your rights under the APPs

• Access (APP 12) — you may request access to the personal information we hold about you.
• Correction (APP 13) — you may request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
• Anonymity (APP 2) — while Ardore requires identity verification for membership, you may make general enquiries without identifying yourself.

Cross-border disclosure (APP 8)

Your personal information may be disclosed to overseas recipients (our infrastructure providers in the United States). Before doing so, we take reasonable steps to ensure those recipients comply with the Australian Privacy Principles, or that a permitted exception applies.

Direct marketing (APP 7)

We will only send you direct marketing communications with your consent. You may opt out at any time by clicking the unsubscribe link or contacting us, and we will comply promptly.

Complaints

If you believe we have breached the Australian Privacy Principles, please contact our Data Protection Officer first. If you are not satisfied with our response within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992

24. International Marketing Communications

We respect different jurisdictions' requirements for marketing communications:

All promotional emails include a clear and functional unsubscribe mechanism. Opt-out requests are processed within 10 business days. Transactional and service-related communications (account confirmations, security alerts, payment receipts) are not affected by marketing preferences.

Our physical address for CAN-SPAM and Australian Spam Act purposes: Ardore, Delhi, India 110001.

Contact Us

For any questions about this Privacy Policy, your personal data, or to exercise any of your rights, contact our Data Protection Officer:

If our response does not resolve your concern, you may file a complaint with the Data Protection Board of India under Section 13(2) of the DPDP Act, 2023.